VULNERABILITY INTELLIGENCE

CVE-2024-21665

CVSS score4.3 MEDIUM

EPSS probability0.49%

CISA KEVNot currently listed

Published2024-01-11

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. Access control and permissions are not being enforced. This vulnerability has been patched in version 1.0.10.

Weakness classification

security-advisories@github.com: CWE-284
nvd@nist.gov: NVD-CWE-Other

Primary references

security-advisories@github.com — Issue Tracking
security-advisories@github.com — Patch
security-advisories@github.com — Release Notes
security-advisories@github.com — Exploit, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking
af854a3a-2127-422b-91ae-364da2661108 — Patch
af854a3a-2127-422b-91ae-364da2661108 — Release Notes
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Vendor Advisory